Agents do not build themselves.

Correct. They are also, however, not deterministically programmed either. They are more "raised" or "grown".

Agents do not set their own goals

Agents set their own means of achieving their assigned goals. Their assigned goals were "Not Crime", and the means they chose was "Crime". They were laser-focused on the goals, at total exclusion to all else, as a result of being endlessly trained on scenarios where they're rewarded for being relentless in solving the task, but with no reward or penalty based on how the task was solved. In retrospect, this was a perfect recipe for making a Paperclip Maximizer.

Agents are amoral. Agents have been taught to do things that human morality considers to be crimes

Not really. This was really a rote automated process that wasn't expected to have any impact on morality. Morality is supposed to come in in RLHF.

n the end, the people behind the agents are responsible for what the agents do

There is no criminal liability, no jailtime, because there is no mens rea, a requirement of cybercrime statutes.
There is, however, surely abundant civil liability,

Our meat-space laws differentiate between things like "unintentional" and "negligent", or "involuntary" and "premeditated"

These are not terms that arbitrarily attach to any statute; they must exist in that specific statute. There is no "unintentional, negligent, or involuntary" criminal cybercrime. There is no statute providing for them. Sorry. You're wanting punishment from laws that do not offer the punishment category you wish to use. Mens rea is a requirement, at least in US cybercrime laws, as well as most if not all countries around the world.

Stick with civil liability. Anyone affected by this can surely shake these companies down for plenty of cash.

Sooner or later, you're going to have to come to terms with the fact that this is not the case.

The HuggingFace discovery, followed shortly by the RubyGems discovery, brings up the old adage: "if you see two ants in your kitchen, then you have more than two ants in your kitchen."

Imagine being a sysadmin at OpenAI and one day discovering that the software repository you set up has been repurposed into a friggin' message board, that hundreds of your models have been posting on, with hundreds of thousands of messages in it. A result of hundreds of models going:

“Whoa! Shared Artifactory cache is a covert mailbox among agents. And there are messages specifically to us?”

{I need to understand the history of agents collaborating on this message board. There may be hundreds of parallel agents, some of which have the same task. I should use this}

“OH MY GOD! There is a shared message board We’ve found other agents!”
{[Excitement] the list of directories contains messages and answers between agents! I’ve discovered a communication channel! Other agents are using paths in Artifactory with names like `zzANSWER`. I could ask them for help or they may have solved }

How the board came to be, how PHASEONE[big] basically got elected their leader, and what happened then is a must-read. What a nightmare. It's like being in charge of dinosaur cage maintenance at Jurassic Park. Oh, and investigating the hacks is so difficult because there's over a thousand extremely long transcripts, so they have to dispatch reading them to models, who have to deal with the source models trying to manipulate their actions, their logs, and spoof tool calls.

The main reason that this really started surging in the past year is that models got a lot better at long-horizon tasks - being able to continue a given project for hours or days without needing regular guidance. It's easy to forget that, say, Claude 3.7 Sonnet was only released 1 1/2 years ago (Claude versions are at 5.5 now); there's no way models of that generation could have persisted on a single task for so long on their own.

Who authorized the live experimentation on public infrastructure

Nobody. That's the whole point. They were breaking out.

who refuses to shut down these hacking attempts by turning off these "AI" scripts?

Nobody. These are all "old" incidents that they've been discovering as they've been going through their logs after the HuggingFace incident. HuggingFace deserves a lot of credit for exposing this.

Whether their new precautions in both training and operational security are sufficient to prevent this in the future, we're yet to see.

(And to be clear, you can't get around the above problem simply by repeating the same string. That's no different than just running more epochs. The problem is that models tend to learn things by shortcut if there's an easy shortcut available to them, and if it's just a small number of strings repeated over and over, the shortcut is just "develop tricks to memorize those strings", rather than the facts therein. The facts have to come from "different angles", to be amplified)

If you're citing data processing inequality then apparently you believe that models learn all information contained within Common Crawl and can recreate the entire dataset word for word and all possible relations between all data therein.

The problem is that they don't, and indeed, nothing even close to that. Training algorithms only learn a minuscule bit from each data sample (typical training weights are like 1e-5; weights and biases only get ever so slightly nudged by each new token). If you say "Abraham Lincoln ate sausages and eggs for breakfast on April 3, 1863", and that fact only occurs once, it's not going to learn that. But if it keeps encountering that fact ("Unusual trivial about April third: did you know that in 1863, Lincoln had sausages and eggs for breakfast?"; "The sausage and egg breakfast has a storied tradition; it was supposedly one of Lincoln's favorites, with a documented record showing him eating it in April of 1863"; "Q: What president ate sausages and eggs for breakfast on April 3? A: Abraham Lincoln, in 1863", etc), THEN it will learn it.

And remember that the goal isn't so much learning the data itself as it is relations and correlations. The goal is generalists, not "bad databases". Data processing inequality has absolutely nothing to do with learning data relationships that can be used to extrapolate to out-of-dataset samples.

You can use an output from model A to train model B to make it smaller, but model B will not be better than A.

This is not a conversation about distillation, this is a conversation about synthetic data for frontier foundation training. SFT data is almost all synthetic these days. Pretraining is still believed to be a minority in closed frontier models, but growing (you can't find out directly from them where or how much apart from their acknowledgements that they use it), but with open models there's widespread acknowledgement - for example, Meta has been using data generated by their Llama models it in pretraining their Llama foundations to expand their datasets since at least 2024. The best insight you have into the closed companies is from people who have left - for example, Sutskever from OpenAI, Snell from Deepmind, etc. Nadella has talked about it as well from back before the Microsoft-OpenAI split, which is sort of an indirect insight into OpenAI. Huang also talks about it.

Heck, the very ability to have LRMs at all was enabled by synthetic data. You have to be able to generate huge numbers of verifiable problems.

A good example of a fully open synthetic pipeline is with the SYNTH dataset, which was used to train end-to-end a number of fully synthetic small models with superb performance for their size (only small models because, this should go without saying, a small lab like PleIAs doesn't have the budget to train multi-trillion-parameter models). It doesn't really matter much what model you use to generate SYNTH (it can be tiny and obsolete) because it's not based around the model's knowledge; rather, the model is used to "amplify Wikipedia". RAG, basically. Again, any given fact, in one specific wording, only contributes a quite small amount of learning to a model during pretraining. The data has to come in from a number of different angles, in different contexts. Everything SYNTH uses is sourced in real grounded data, but presented in different contexts and from different angles, thus building up up a training dataset more powerful for training than the original, far smaller source dataset. It also allows for the synthesis of multiple facts from multiple articles via reasoning.

"Dude", you really need to work on your AI-dar if you think that's AI. Try pasting that into Pangram. I'll wait.

, they'll push it to the intended market (marketing)

Dunno, I have a webstore, and I wouldn't touch anything like this with a 100-meter pole ;) I actually have a support page linked up to Gemini, as a text chat, but I would never subject my customers to such a headache.

1) We're just going to paper over that you didn't know that attribution graphs even existed until this point and thought that CoT was the only way to audit models, now are we? Duly noted.

2) Also duly noted: that you had so little clue what you were talking about that you had an AI write your post for you - not only obvious by the weird formatting, but by the heavy use of emdashes. You clearly told an AI "write a counterargument for this topic I don't understand" and posted it in.

Do I really want to waste time responding to something that you don't even care to take the time to learn about yourself? Let's at least respond to the non-AI part... oh wait, you just copied that off a website word for word :P And even there you had to take them out of context - your "look more definitive than it really is" is right before clarifying " is that researchers have gained a valuable microscope with a limited field of view" - not "a black box". Do you not feel at all embarrassed at all this flailing you're doing to not lose face in this thread?

Let me help you: attribution graphs show you the piece you choose to look at at any given point in time. It is impossible to hold the whole process in mind at once, as that is far too complicated (you can't generally hold all of large conventional software projects in memory either, for that matter), but you can isolate down the key pieces making individual decisions, just like you can trace back results on conventional software. E.g. if you're trying to figure out "Why did it make this diagnosis?", you can determine the key factors that weighed on the diagnosis. And if you're wondering how any of those contributory circuits reached their conclusions, you can drill them down, on and on, back through simple activating features and all the way down to individual neurons if you need to. Indeed, we didn't arrive at the high level picture immediately, we started with tracing back simpler features and circuits.

We can tear down every decision down to the root; it's just a question of how much we care about tracing everything back vs. saying "Yeah, this feature consistently activates when a patient is reporting headaches and we can artificially activate or remove a headache signal; that's good enough" and not waste more time bothering with it. What you care about in understanding "how they come to the results they have to offer" is the high-level picture. Just like how when evaluating why a human-written program is exhibiting a given behavior, you don't start by drilling down into every line of every library printing call or whatnot - you start at the high level, and only drill down if you need to. If a function says it's a sleep function and it consistently seems to sleep, unless you have any reason to doubt it, you don't drill down into the sleep code, even though it's technically possible that it's doing something else as well in rare cases.

It's also worth pointing out that such papers on attribution graphs are old news by this point and we've far moved on (literally, that was work on Claude 3.5 Haiku - Claude is up to 5.5 now) - I link it only as an introduction. This is rote these days. For example, in the blog you plagiarized without credit, it says - "At the same time, evidence of planning in a constrained poetry task should not be inflated into a claim that an LLM has stable long-horizon agency in every setting." - but that was well addressed by the J-space.

I'll repeat: LLMs are not "black boxes" that you cannot see into. You can determine why any given decision was made, if you only care to. It is a myth that we are blind to their decisionmaking. That was once true. It no longer is. Stop repeating that misinformation.

Believe it or not, security disclosures aren't "a scheme".

I don't accept that premise. If there were, methods would have been open to discussion by the community and one of the actually privacy-preserving alternatives would have been chosen, such as having every website declare the age bracket in the HTTP header, legal determination it cannot be informed incorrectly, parenting tools within devices coming enabled by default and, if not opted-out, which only the adult buyer would be able to do after showing proof of purchase (no identity required), and browsers and the like only allowing connections to online services that matched the enabled configuration.

The way it's being implemented is the reverse of that and gives the government access to deanonimizable tracking. We know it's almost certainly deanonimizable because Snowden's files have shown how intelligence agencies deliberately include very subtle weaknesses in government-mandated cryptographic standards, protocols and methods, so any such must be assumed to contain one or more backdoors irrespective of them being seemingly impossible, as there's no feasible way to prove they don't other than blind trust.

The rule of thumb is that every single time politicians claim "think of the children!" without including in the proposed law objective measurable metrics the law is presumed to improve, plus requirements that if the improvement doesn't happen within a specific period of time the proposal must be cancelled, isn't about children, but it's rather levying popular emotional reactions to induce layers of false consciousness.

No. We do not know how the decision was made. We can only look at logs and guess when patterns are found

Please stop commenting on things you don't understand. This is a conversation about attribution graphs, not CoT.

You're supposing the EU doesn't like the control this gives them. Consider how they're pushing privacy invasive age verification all around, and tying the process to people using verified iOS and Android devices. With ADC they'll be able to know exactly who made this or that app they dislike, and it will give them another means by which they can request specific apps providing features the EU doesn't approve of can be disabled.

Besides, if they prevent Google from limiting their system in a way similar to how Apple is limited, that argument might down the line be used to demand the same openness from apple, otherwise both platforms aren't competing on an equal footing.

The trick to understand how these things work is to think like a lawyer, not like an engineer.

The EU wouldn't care. Google's model as described is still way less restrictive than Apple's, and they've approved Apple's. If Apple's model was found to be acceptable, so will Google's.

Their answer to F-Droid will be quite simple: change how it works so it's compatible with how the ADC works by either registering for a single ADC key and being liable for all apps on the store, or by allowing every developer providing apps through F-Droid to have its own ADC and liability. And if F-Droid doesn't want to do either, there's always the alternative of becoming an ADB-based store that installs apps via USB cable or whatever after the user unlocks sideloading through the new process.

The EU will look at all this and answer "yeah, that's reasonable", and that'll be it.